Can research run on data that names no one?

Hospitals hold years of records that could answer real medical questions: which treatment works for which patients, which side effects show up late, which illnesses are on the rise. To answer them, researchers rarely need to know who a patient is. They need the diagnosis, the treatment and the time between the two. The difficulty is to give them all of that without handing them a person as well.

The name is the easy part

In 2000, Latanya Sweeney, then at Carnegie Mellon University, worked through the 1990 census of the United States. She found that “87% (216 million of 248 million) of the population” could probably be told apart from everyone else with just three facts: their five-digit ZIP code, their sex and their date of birth. None of those three facts is a name. Together, they work like one. With the town in place of the ZIP code, she still found 53% of the population probably unique.

Figure 1

Remove the name

Interactive

Copy for a research team

A fictional patient’s record

• Name

  Elena Marsh

  Kept
• Sex

  Female

  Kept
• Date of birth

  14 March 1961

  Kept
• Postcode

  20314

  Kept
• Diagnosis

  Asthma

  Kept
• Treatment

  Inhaled corticosteroid

  Kept

People who fit this record

1

out of 24,000

Her name is on it.

Try itRemove the name and watch how many people still fit the record.

Remove the name

The record names her, so of course only she fits it.

The lesson still holds. Removing the name is necessary, but it is not enough. What makes a record name no one is what happens to everything else in it. The figure above shows it on a fictional population: remove the name, and one person still fits the record.

What the rules say

Laws draw this line in different words. In the United States, the HIPAA Privacy Rule offers two ways to make health data no longer point to a person. One removes a list of details, including “all elements of dates (except year)” linked to a person and any area smaller than a state, with a narrow exception for the first three digits of a ZIP code in areas of more than 20,000 people. The other asks an expert to find that “the risk is very small” that the data could be used to identify someone. Even this rule speaks of a small risk, not of none.

In Europe, the GDPR deals with pseudonymised data, where the name has been replaced by a code. It says that such data, if it “could be attributed to a natural person by the use of additional information”, should be treated as information about a person who can be identified, so its protections still apply. Only information that no longer allows anyone to be identified falls outside it.

The approaches differ, and each country has its own. They agree on one point: what matters is not whether the name is there, but whether the person can be found again.

What Vita does

Vita is the health application of our platform. It brings together what a hospital, a pharmacy and an insurer each record about a patient. Doctors and nurses keep the full, named record that care requires. On the way to the research workspace, the record changes: a code replaces the name, only the year of birth remains, and the address shrinks to a region. The diagnosis and the treatment are left as they are. The names are removed before the data reaches researchers, not hidden afterwards.

We do not call the result anonymous. A record that still carries a code, a year and a region is a record about someone, and some laws, the GDPR among them, treat data like this as personal. Calling it anonymous would be easy. It would also be a promise the hospital could end up answering for.

What a hospital needs is a research copy it can stand behind: no names, dates and places made less precise, the medical facts intact, and its own country’s rules applied to the rest.

How to check it

1. Open one record from the research copy and list every field left besides the medical facts. Each one should have a reason to be there.
2. Count, on your own patients, how many people share that record’s year of birth, region and sex. The more people share it, the harder it is to single anyone out.
3. Ask who can link a code back to a name, if anyone can, and where that link is kept.

Next on the record · #1Where does Datasight run, and under whose law?

Sources

1. Latanya Sweeney, “Simple Demographics Often Identify People Uniquely”, Carnegie Mellon University, Data Privacy Working Paper 3, Pittsburgh, 2000. Data Privacy Lab
2. 45 CFR § 164.514(b), HIPAA Privacy Rule, “Requirements for de-identification of protected health information”. Cornell Law School
3. Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation): Recital 26. EUR-Lex